Every CVE Search/ Get API key

CVE-2014-9112

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote...

5.0 MediumFix available

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

Exploit likelihood

7.09%Up 4.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

Record
CVE-2014-9112
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

Record
CVE-2014-9112
Updated
2026-11-02
EUVDEUVD-2014-8938 No score

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

Record
EUVD-2014-8938
Updated
2026-11-03
GitHub AdvisoriesGHSA-wvrh-73qw-9vj9 No score

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote...

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

Record
GHSA-wvrh-73qw-9vj9
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

Record
CVE-2014-9112
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9112 No score

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

Record
DEBIAN-CVE-2014-9112
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0528 No score

Updated cpio package fixes security vulnerability

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive (CVE-2014-9112).

Additionally, a null pointer dereference in the copyin_link function which could cause a denial of service has also been fixed.

Record
MGASA-2014-0528
Updated
2026-11-02
OSVopenSUSE-SU-2024:10143-1 No score

cpio-2.12-3.90 on GA media

These are all security issues fixed in the cpio-2.12-3.90 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10143-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-9112 No score

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

Record
UBUNTU-CVE-2014-9112
Updated
2026-11-02
OSVUSN-2456-1 No score

cpio vulnerabilities

Michal Zalewski discovered an out of bounds write issue in the process_copy_in function of GNU cpio. An attacker could specially craft a cpio archive that could create a denial of service or possibly execute arbitrary code. (CVE-2014-9112)

Jakob Lell discovered a heap-based buffer overflow in the rmt_read__ function of GNU cpio's rmt client functionality. An attacker controlling a remote rmt server could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-0624)

Record
USN-2456-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cpio
Debian:12
 before 2.11+dfsg-4
2.11+dfsg-4
cpio
Debian:13
 before 2.11+dfsg-4
2.11+dfsg-4
cpio
Debian:14
 before 2.11+dfsg-4
2.11+dfsg-4
cpio
Debian:6.0
 before 2.11-4+deb6u1, plus listed versions
2.11-4
2.11-4+deb6u1
cpio
Debian:7
 before 2.11+dfsg-0.1+deb7u1, plus listed versions
2.11+dfsg-0.1
2.11+dfsg-0.1+deb7u1
cpio
Mageia:4
 before 2.11-6.2.mga4
2.11-6.2.mga4
cpio
Red Hat:enterprise_linux:7::client
 before 0:2.11-24.el7
0:2.11-24.el7
cpio-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.11-24.el7
0:2.11-24.el7
cpio
Red Hat:enterprise_linux:7::computenode
 before 0:2.11-24.el7
0:2.11-24.el7
cpio-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.11-24.el7
0:2.11-24.el7
Show 6 moreShow less
Affected packages
PackageAffectedFixed
cpio
Red Hat:enterprise_linux:7::server
 before 0:2.11-24.el7
0:2.11-24.el7
cpio-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.11-24.el7
0:2.11-24.el7
cpio
Red Hat:enterprise_linux:7::workstation
 before 0:2.11-24.el7
0:2.11-24.el7
cpio-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.11-24.el7
0:2.11-24.el7
cpio
Ubuntu:14.04:LTS
 before 2.11+dfsg-1ubuntu1.1, plus listed versions
2.11+dfsg-1ubuntu1
2.11+dfsg-1ubuntu1.1
cpio
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 2.12-3.90
2.12-3.90

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9112 is a medium vulnerability (CVSS 5.0) in Gnu Cpio, published December 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.09%, the 94th percentile. Fixed in cpio 2.11+dfsg-4.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open